Investigator · Lesson 06

What can ping and ICMP tell you?

Ping uses ICMP (Internet Control Message Protocol) to test one kind of reachability, but it does not fully describe a TCP (Transmission Control Protocol) service.

The central problem

Separate reachability from service health.

Good network reasoning separates the mechanism from the symptom. Start with the boundary, identify the evidence, and test the explanation that accounts for the observation.

One signal rarely proves the whole path.Compare observations from the relevant layer before changing a configuration.

Interpret the result

An ICMP failure is not automatically a service failure.

Ping sends an ICMP Echo Request and waits for an Echo Reply. A timeout can come from filtering, packet loss, a disabled responder, or a policy that ignores ICMP while allowing the intended service.

Test the question at the same layer as the user problem: use a transport check for a port and an application-aware request for a web service. A successful ping shows that one ICMP exchange worked at that time; it does not prove that every service is healthy.

Match the probe to the claim.Ping can answer an ICMP reachability question. It cannot, by itself, answer whether a TCP service accepts connections or an application returns the right response.

Build the model

Four useful signals

01

Echo

Shows whether an address and path answered ICMP.

02

Latency

Measures a round trip at one point in time.

03

Loss

Shows missing probe responses.

04

Service

Requires a transport and application check.

Mini investigation

Inspect the evidence

Select the observation and identify the most direct next check.

NEXT CHECKDirect evidence

This observation narrows the mechanism but does not prove every downstream layer.

Compare it with one nearby-layer check.

Knowledge check

Test your model

Answer five questions.

0 / 5